No Denial

Stephen Smalley sds at
Mon Dec 20 21:41:24 UTC 2004

On Mon, 2004-12-20 at 16:39, Browder, Tom wrote:
> Actually, I did a 'make load', rotated my logs to clear them out, and
> then did 'mv /etc/shadow /etc/' as a normal user and got a
> long denial log message (get_attr). 

Yes, but that is just for the stat(2) attempt (stat => getattr), not for
the rename(2) call, which would never reach the SELinux checks unless
you first pass the Linux DAC checks.

Stephen Smalley <sds at>
National Security Agency

More information about the fedora-selinux-list mailing list